How to Draft the MD&A Section: Management Discussion and Analysis in an S-1 Filing

The SEC’s 2024 final rule on cybersecurity disclosure (Release Nos. 33-11216; 34-97989), effective for annual reports for fiscal years ending on or after December 15, 2023, has fundamentally altered the burden placed on the Management Discussion and Analysis (MD&A) section of a Form S-1 registration statement. Issuers filing for an initial public offering on the NYSE or Nasdaq in 2025 must now integrate a detailed discussion of cybersecurity risk management, strategy, and governance into Item 303 of Regulation S-K. This is not a separate disclosure block but a required component of the MD&A narrative, directly linking a company’s cyber posture to its financial condition and results of operations. For Hong Kong-based issuers—particularly those with PRC operations structured through Cayman or BVI holding companies—the interplay between SEC requirements and the HKEX’s own cybersecurity guidance (HKEX Guidance Letter GL86-16) creates a dual compliance burden. A failure to adequately draft the MD&A, specifically regarding known trends and uncertainties, has been the single most common reason for SEC comment letters delaying a registration statement’s effectiveness in 2024, per data from the SEC’s Division of Corporation Finance. The following analysis provides a structured, rule-by-rule approach to drafting this critical section.

The Regulatory Framework: Item 303 and the SEC’s 2024 Cybersecurity Rules

The foundation of any MD&A is Item 303 of Regulation S-K, which requires a discussion of liquidity, capital resources, results of operations, and known trends. The SEC’s 2024 cybersecurity final rule (Release Nos. 33-11216; 34-97989) amended Item 303 to explicitly require disclosure of management’s role in assessing and managing material risks from cybersecurity threats. For an S-1 filer, this means the MD&A must address three distinct layers: the company’s processes for identifying and assessing material cybersecurity risks, the effect of those risks on the company’s business strategy and financial outlook, and the board’s oversight of cybersecurity risk.

Materiality Assessment as the Threshold

The SEC has clarified that materiality is assessed from the perspective of a reasonable investor. An issuer must evaluate whether a cybersecurity incident, or a pattern of incidents, is material to its financial condition. For a Hong Kong-based fintech or biotech company listing on the Nasdaq, this could involve quantifying the cost of a data breach, the loss of intellectual property, or regulatory fines from the HKMA or the SFC. The MD&A must explicitly state the criteria used for materiality—for example, a threshold of 5% of revenue or a specific dollar amount. If no material incidents have occurred, the MD&A must still describe the risk assessment process, as the absence of incidents does not obviate the need to discuss risk management.

Integration with Financial Statements

The MD&A must cross-reference the financial statements. If a cybersecurity incident has resulted in a reserve or a contingent liability, that line item must be discussed in the MD&A alongside the narrative of how the incident arose. The SEC’s Division of Corporation Finance has issued comment letters requesting that issuers explain the relationship between a disclosed cybersecurity risk and a specific decrease in gross margin or an increase in operating expenses. For example, if a ransomware attack caused a two-week production shutdown, the MD&A must quantify the revenue lost and the recovery costs incurred, tying these figures directly to the income statement.

Structuring the MD&A for a Cross-Border Issuer

For a company incorporated in the Cayman Islands or Bermuda with operating subsidiaries in the PRC and a Hong Kong listing sponsor, the MD&A must address jurisdictional risk factors that are distinct from those of a US domestic issuer. The SEC’s 2021 amendments to Regulation S-K regarding human capital management (Release Nos. 33-11030) also apply. The MD&A must discuss how the company manages human capital resources, including reliance on PRC-based engineers or Hong Kong-based compliance officers.

Known Trends and Uncertainties

Item 303(a)(3)(ii) requires a discussion of known trends or uncertainties that are reasonably likely to have a material impact on revenue or income. For a PRC-based issuer, this includes the trend of increasing regulatory scrutiny from the China Securities Regulatory Commission (CSRC) and the Cyberspace Administration of China (CAC). The MD&A must explicitly state whether the issuer has obtained the necessary filings under the CSRC’s 2023 regulations for overseas listings (effective March 31, 2023). If the issuer has not yet filed, the MD&A must describe the uncertainty and its potential impact on the offering’s timing.

Liquidity and Capital Resources

The MD&A must discuss the issuer’s ability to generate cash from operations and its access to external financing. For a Hong Kong-based company with a VIE structure, the MD&A must disclose the contractual arrangements that allow the issuer to control the PRC operating entity and the associated risks of PRC regulatory changes. The SEC’s 2021 guidance on VIE disclosures (CF Disclosure Guidance: Topic No. 9) requires that the MD&A discuss the specific contractual terms, including the profit-sharing mechanism and the termination rights. The MD&A must also quantify the cash held by the PRC subsidiary versus the Cayman holding company, as restrictions on cross-border capital movements are a known trend.

The Cybersecurity Narrative: From Risk to Financial Impact

The SEC’s 2024 final rule mandates that the MD&A include a description of the board’s oversight of cybersecurity risk and management’s role in assessing and managing material risks. This is not a boilerplate statement. The MD&A must specify whether a specific board committee (e.g., the audit committee or a dedicated risk committee) has cybersecurity expertise. For a Hong Kong-based issuer, referencing the HKEX’s Corporate Governance Code (Code Provision D.2.1) which requires board-level risk oversight can provide useful context, but the SEC’s standard is stricter.

Incident Response and Disclosure

If a material cybersecurity incident has occurred within the four fiscal years preceding the S-1 filing, the MD&A must describe the incident, its financial impact, and the steps taken to remediate it. The SEC has specified that the disclosure must be made on a Form 8-K within four business days of the incident’s determination as material. For an S-1, this means the MD&A must incorporate any such 8-K disclosures by reference. If no incident has been disclosed, the MD&A must still describe the incident response plan, including the roles of the chief information security officer (CISO) and the external incident response firm.

Quantifying Cyber Risks

The MD&A should quantify the financial exposure to cybersecurity risks where possible. This includes the cost of cyber insurance premiums, the estimated cost of a potential data breach (using third-party models such as the IBM Cost of a Data Breach Report 2024, which reported an average cost of USD 4.88 million per incident for the healthcare sector), and the capital expenditure on cybersecurity infrastructure. For a fintech issuer subject to the HKMA’s Cybersecurity Fortification Initiative (CFI), the MD&A must discuss the compliance costs associated with the CFI’s three pillars—cyber resilience assessment, professional development, and threat intelligence sharing.

Segment and Product-Level Analysis

For issuers with multiple operating segments, the MD&A must provide a segment-level discussion of results of operations. This is required under Item 303(b)(2) of Regulation S-K, which mandates a discussion of revenue, gross profit, and operating income for each reportable segment as defined under ASC 280 (Segment Reporting). For a Hong Kong-based conglomerate listing on the NYSE, the MD&A must explain the performance of each segment—for example, property development in the PRC versus asset management in Hong Kong—and how cybersecurity risks affect each segment differently.

Revenue Recognition and Key Drivers

The MD&A must discuss the primary drivers of revenue growth or decline. For a SaaS company, this includes customer acquisition costs, churn rates, and average revenue per user (ARPU). The SEC has emphasized that the MD&A should not merely restate the financial statements but should provide management’s perspective on the underlying business drivers. For example, if the company’s revenue growth is driven by a new product line in Southeast Asia, the MD&A must discuss the regulatory risks in those jurisdictions, including data localization laws in Singapore or Thailand.

Cost Structure and Margins

The MD&A must analyze the components of cost of revenue and operating expenses. For a biotech issuer, this includes research and development costs, clinical trial expenses, and manufacturing costs. The SEC’s 2023 guidance on inflation and supply chain risks (Staff Accounting Bulletin No. 121) requires that the MD&A discuss how rising input costs—such as raw materials or logistics—affect gross margins. For a Hong Kong-based logistics company, the MD&A must quantify the impact of fuel price increases and labor shortages on operating margins.

Comparative Period Analysis and Forward-Looking Information

The MD&A must include a year-over-year comparison of results of operations for each of the three most recent fiscal years (or for the stub period if the issuer has a short operating history). This is a strict requirement under Item 303(a). The narrative must explain the reasons for material changes, using both quantitative and qualitative analysis. For example, if revenue increased by 12% in the most recent fiscal year, the MD&A must attribute that growth to specific factors—such as a 15% increase in unit sales volume and a 3% decrease in average selling price—rather than a generic statement.

Non-GAAP Financial Measures

If the issuer presents non-GAAP financial measures—such as Adjusted EBITDA or Non-IFRS Net Income—the MD&A must include a reconciliation to the most directly comparable GAAP measure. The SEC’s Regulation G and the Compliance and Disclosure Interpretations (C&DIs) on non-GAAP measures require that the MD&A explain why the non-GAAP measure is useful to investors and how management uses it internally. For a Hong Kong-based issuer that reports under IFRS, the MD&A must clearly state the adjustments made to arrive at the non-GAAP figure, such as adding back share-based compensation or impairment charges.

Forward-Looking Statements

The MD&A must include a discussion of known trends and uncertainties that are reasonably likely to affect future results. This is where the issuer’s risk factors—such as PRC regulatory changes, US-China trade tensions, or cybersecurity threats—are translated into specific financial impacts. The SEC’s Private Securities Litigation Reform Act (PSLRA) safe harbor for forward-looking statements applies, but only if the MD&A includes meaningful cautionary language. The MD&A must identify the specific assumptions underlying any forward-looking projections, such as expected revenue growth rates or gross margin targets.

Actionable Takeaways

1. The MD&A must explicitly integrate cybersecurity risk management, board oversight, and incident response processes as a required component under the SEC’s 2024 final rule on cybersecurity disclosure, not as a separate risk factor.
2. For cross-border issuers with PRC or Hong Kong operations, the MD&A must quantify the impact of known trends such as the CSRC’s overseas listing filing requirements and the CAC’s data cross-border transfer regulations on liquidity and capital resources.
3. Segment-level analysis under ASC 280 is mandatory; the MD&A must provide a detailed explanation of revenue and margin drivers for each reportable segment, including the impact of jurisdictional regulatory risks.
4. Non-GAAP financial measures must be reconciled to the most directly comparable GAAP or IFRS measure, with a clear explanation of each adjustment and its relevance to management’s internal decision-making.
5. Forward-looking statements in the MD&A must be supported by specific, identifiable assumptions and accompanied by meaningful cautionary language to qualify for the PSLRA safe harbor.